=�z���}a��3�}v��Nx�;V��|L�1��AY�ut[��<���Aov��u�3��%��Q�T���D%]C���܊����wݴ=!J3��]��*f��D�XA�ۧ`�ͧ9܈<����f�]����:����A�5��S��~;?��o�<2'�e��G�Z��u͜'�o��wc�+��S���ƆMW � ��O��'d�����7�������1 �i�ٽ5���F�;+6�yy��E��.���<* G���(���*4��������Q�'�)��V�̲d�������q��%�f�Q�p��l���}�,���P�1�0))��@�=M�"z%�U��ěʺh����y�`_F�bt�]띭I�ʈ{� �0���2p�)�.~��!������Q�.��G��g���IA׆so���g��lX ��nA�����3���0��%[#@��p���A�S��e\�?��*��G@��>i-��:�{��`����k�_)/L�� �ZA��X}��À����K�����yؾn�ʭE^��M�S��?T˄���Ԧ\IX�y겗I$H�ֽEVV���RC���ףe��dS���ز����("~�eRfJhh�f�h�_�� }r��K����M�:�i5[�*R�M�̲{�@S'�r�d���/���b�f���f��/},D����}��%Β`�q��M�nQ�}��E�3��V�v}1"+�IkM��t�����K�@�|aB�$�rfM�b�P�U���J��*C��� &�[�W��୰��-��6��\�7>�8�x~'�3��}�����X��J]����`�0����*i,�@��y�ꭃS4�CH@������s�O�_`�z�q��L@��RR�_}�v&�m<:��҃wd�pC�e*�����1S��ˌ�l݁#l���ڊL���>�^��ʐH_�v#nB�:��"v�4���!���U�.��|V�����,���� �W�٪䏒�h�bl@~���Z u�������r &�1�E7�� ����R�q�t�}˗㇂4pU��Ԛ��.��"��Z�]�Zy��Q�t��u�v�d���q��y�FYӴ��� ���$�*$����y1��<����Γ���UV�,��eBn��$!,()$f�@/!�`ǹ��[�4�7QĦ�^F�K��y��A��~�ר.F��n=喃�( F��8l�F�]�[�j�Q��sNv�YSH/,�� ��-�Y�:u�.+�c�?w�I10�� m0�b��1�k����u�qҘ��a��=mv㰷'�ѵ{�_�&��E�c,�G��Ä�k;�����a�q<��\��r��R���t݇'�e6Cp�uc2L����g�'�mn��*FT^�>���T=�kԈo�:`��oJ��B�DZ!�mL&���*�㤌n>`�d;�ᯗU1�27�!f���'5X5{�I[��^':)N���bVm���f����ćo���}�y�g<rr w�����ʕR�i[���/��V$<wht��.�%���CU��� wFR>��g�|\�;I����@�[KB����P���?� ����w�`c��p+g=�Dajf<�2����*Dj���ւb�Ζ��![i(�C'�!�Z�H��uc�+���A=H�]zhW����2��ہTk������:���KOY�Qv�g�$�T�K�E КlV�9���'�?C��Z({wU`@�0���}ѹ\ t<�u��[P�"MkB�8�t ޚ���Y+����^t�����>��#���5Z��a<1fbJ���`�Fz&�J:3���T�8�i\mQ���V�Or�������)$q����T�Ɛ,�j�f�����V��i%��m��R��Lu�L�#����DW��>�5"�p���S�iS��T �w�ݦ����b�?,p�*���V[���\Fc���G^��m?�({���.�m�p�p n�G�q�ooj�2\9�%0�̃*�e.ͱ��ڝ�nfb��>u{�U�I��u֭\��n�"Q�Q�8 ��o0�\A��!j�k��$�z9+��}��#��s�U�Q��)y��g�r>/d`�BO=I/��l��`5��x�|�.*���(��x�g���5[Ȱ)D.�@�����,���b-�#d�5?�����A�嬖R��n��z��D�T���s� qޥ{>����� ������a� .��,��V'�)�5��Z����(�*3�jb��� gi�+6���u���V����Fa5��f2&���D���.��m��_ć��1�Gt�!X�9��&6;,x����c-ʙ�(@� �l:���v�������nA� }@V��s�>�vL�<�w����X��2�P����!��us2%���W�Q��b��â���ʬx"��3*�Qo�e�H�2;ё��U���P�5VJ��F����@[ʲ�߈�?���aT��(�y��X⿉<&��V�����M�`m8`�+@�ٜ���fgY��KzN�q��O�4�vd�-aJ{� ��3l!D44�]0x$�J����,�#b��T�1�A�; ����֚It����1;���1����|�/�b��FգΝ��w�/�BR�EΞZ��>��!Qza�wјv죚��V����\��rU��c@s�T��/)�Ǔ��3���Q���4�7W�����)��X�?�/`a����8�>��v��J�'��$ /\ӌh`Kt��dk����h�T�-���n���z��Q��^�߾�>���/9��� X��L�I �NE�@FZ��kuKⲧ2�t��.�~:i�b�}�4:���j˻�Z�̀b�{�sa ͥ]_�w���o�|����j\�`Ă��>S~� �wcTpc/0X�O6��gJ:*A���%e):���j� S3j럃'�{��r1�53��<�O�?Hy}�ܹ�ͼ�3���n����k�KsO���������n��� ��%�9��O�TQ/\����R��*2X���*�=�?��a�w<�ɸ����ҩE�Y>ө����N�#��g��nq�7#��Jd�r�$śc#&ă��;��ccEl�N��
Static task
static1
Behavioral task
behavioral1
Sample
HARMAN LOADER_78.exe
Resource
win10v2004-20240802-en
General
-
Target
HARMAN LOADER_78.exe
-
Size
7.1MB
-
MD5
75bdd96f5e835f03ddece9fa8f0b7546
-
SHA1
1e671f2a4f15dd1a5d6b8822cc71f7b1c6f637eb
-
SHA256
fd9a5cc1cadf673c9ac98b1a1dbb8e9e4ed043625bf77ef74b8b76d224600025
-
SHA512
119c52573209f41b3e0855df896a03747e3d56eecb00a7546c77873142984b308030d4715671799af2a2f78886fae2f6e893f663bde3848447a52e7993a780ff
-
SSDEEP
196608:pKiTwVawHFNKyLJShsl0pCo2cauaKQPYH8CU:pLwlgyTQv2caxYH8N
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource HARMAN LOADER_78.exe
Files
-
HARMAN LOADER_78.exe.exe windows:6 windows x64 arch:x64
5cba3334f6b90212d8dd34583c596682
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
kernel32
RtlVirtualUnwind
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ReleaseCapture
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateRoundRectRgn
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
imm32
ImmReleaseContext
dwmapi
DwmExtendFrameIntoClientArea
normaliz
IdnToAscii
wldap32
ord211
crypt32
CertFreeCertificateChain
ws2_32
gethostname
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
fwrite
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
acosf
advapi32
OpenProcessToken
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 688KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ